243c759ce8734b424d2b3a2069877e1ace73f791c733c42763d088b7a0a0cede

Sharing

Copy URL Twitter E-mail

General

Target

243c759ce8734b424d2b3a2069877e1ace73f791c733c42763d088b7a0a0cede
Size

4.8MB
MD5

35ffb24667e6fedb12d2c9fd0a820b2a
SHA1

710f270706c5bb0f5fd770cc39ecdb87ba2f7199
SHA256

243c759ce8734b424d2b3a2069877e1ace73f791c733c42763d088b7a0a0cede
SHA512

3df943259acbb5cc0084dd8bde2f6d7118be291718f7504f7ee9c5b60a9d7085686bbb3ff69aee9a6b819df204a9250dcdded05e3111e31cd788e572d6377137
SSDEEP

49152:WF4YHZuYrOA3eHb3SW3A3bIeyEtXWuXvGh7uTItq+eoe4rOAXXQKN4Qgyt5mY/7+:GZZrT4ze0htqLS4d0fW7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
243c759ce8734b424d2b3a2069877e1ace73f791c733c42763d088b7a0a0cede

Files

243c759ce8734b424d2b3a2069877e1ace73f791c733c42763d088b7a0a0cede
.dll windows:6 windows x64

2988b863e60b5a606803e16d3c7551d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

d3d11

D3D11CreateDevice

d2d1

ord1

dxgi

CreateDXGIFactory1

mfc140u

ord1631
ord3713
ord2415
ord12779
ord13761
ord12240
ord9068
ord4499
ord12963
ord5245
ord6250
ord4946
ord2903
ord9392
ord4335
ord13199
ord5672
ord2909
ord5237
ord3825
ord13679
ord12967
ord12763
ord2475
ord6320
ord3756
ord2270
ord6313
ord4722
ord2473
ord1086
ord438
ord12706
ord5240
ord13864
ord13136
ord4668
ord3599
ord1057
ord6258
ord8900
ord5916
ord11902
ord8819
ord2698
ord13401
ord6002
ord3058
ord4081
ord8439
ord12442
ord3746
ord14128
ord3579
ord4669
ord3697
ord11813
ord8731
ord11085
ord357
ord12761
ord480
ord1119
ord2686
ord13767
ord3726
ord8451
ord7182
ord3742
ord7394
ord878
ord1369
ord8501
ord8063
ord2311
ord2351
ord6636
ord3308
ord13570
ord13568
ord3307
ord3071
ord6000
ord13397
ord3212
ord13569
ord6638
ord7619
ord6906
ord4084
ord14194
ord1158
ord13955
ord4724
ord13257
ord7780
ord8409
ord5628
ord3209
ord7913
ord5604
ord13307
ord13299
ord7249
ord2922
ord305
ord5710
ord2697
ord13949
ord2921
ord285
ord5709
ord1643
ord14360
ord2418
ord9976
ord9978
ord9977
ord4949
ord9975
ord9979
ord5451
ord4948
ord5675
ord11414
ord12241
ord11415
ord316
ord8830
ord11771
ord300
ord306
ord3748
ord2907
ord8440
ord4083
ord3096
ord8822
ord6342
ord1157
ord528
ord1149
ord6247
ord3718
ord3089
ord3678
ord4721
ord12746
ord886
ord6549
ord12762
ord3598
ord4343
ord1034
ord1508
ord1511
ord1674
ord11625
ord14209
ord1677
ord6262
ord8656
ord1430
ord4181
ord7893
ord1667
ord964
ord1491
ord296
ord1033
ord280
ord8161
ord1641
ord290
ord1504
ord983
ord1450
ord323
ord1039
ord2212
ord4656
ord286
ord990
ord1454
ord2487
ord3951
ord3841
ord4726
ord1489
ord4947
ord265
ord1503
ord5674
ord266
ord1501
ord8452
ord2269
ord4655
ord4510
ord12563
ord2689
ord3828
ord2149
ord2414
ord9159
ord8823
ord7745
ord14027
ord8058
ord2350
ord2346
ord6848
ord1670
ord1671
ord446
ord1089
ord1632
ord1510
ord11772
ord7233
ord14043
ord1665
ord10163
ord1668
ord10704
ord4511
ord2906
ord8901
ord9946
ord7922
ord11854
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord5227
ord7450
ord7461
ord7460
ord5062
ord5229
ord5083
ord3728
ord1492
ord324
ord1040
ord2327
ord2369
ord2372
ord2338
ord2371
ord473
ord2234
ord2336
ord2161
ord2266
ord2360
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord11406
ord13354
ord5582
ord5723
ord2629
ord11806
ord3812
ord3279
ord3278
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
SetFileTime
GetCurrentDirectoryW
GetTimeZoneInformation
LocalAlloc
LoadLibraryExW
lstrcmpA
CreateSemaphoreW
lstrcmpiA
GetUserDefaultLangID
GetPrivateProfileIntW
GetCurrentThread
TryEnterCriticalSection
GetSystemInfo
SetFilePointerEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreA
TlsFree
GetSystemTimeAsFileTime
TlsGetValue
TlsAlloc
GetCurrentThreadId
ReleaseSemaphore
TlsSetValue
GetACP
OutputDebugStringA
CreateEventW
InitializeCriticalSection
ReadFile
SystemTimeToFileTime
FileTimeToSystemTime
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
InitializeSListHead
ExpandEnvironmentStringsA
GetFileSizeEx
GetLongPathNameW
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetExitCodeThread
GetCurrentProcess
LoadLibraryExA
MoveFileW
FindResourceW
lstrlenW
lstrlenA
lstrcatW
lstrcpyA
lstrcpynW
lstrcpynA
lstrcmpiW
lstrcmpW
FormatMessageW
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FreeResource
FreeLibrary
FindResourceExW
GetVersionExW
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
CloseHandle
OutputDebugStringW
WriteFile
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
GetTempFileNameW
GetShortPathNameW
GetFullPathNameW
GetFileTime
GetFileSize
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
CompareFileTime
WaitForMultipleObjects
SetEvent
ResetEvent
WideCharToMultiByte
TerminateThread
WaitForSingleObject
DeleteFileW
lstrcpyW
Sleep
MulDiv
InitializeCriticalSectionAndSpinCount
GetTempPathW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
MultiByteToWideChar
GetProcAddress
GetModuleHandleW

user32

DialogBoxIndirectParamW
CharUpperW
CreateDialogParamW
DestroyWindow
IsDlgButtonChecked
SendDlgItemMessageW
SetWindowTextW
EndDialog
SetWindowLongPtrW
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
IsRectEmpty
SetRectEmpty
GetWindowLongW
GetSystemMetrics
IsIconic
GetWindowRect
OffsetRect
IntersectRect
LoadStringA
EnableWindow
SendMessageW
CopyRect
GetFocus
GetClientRect
FillRect
GetClassNameW
GetDesktopWindow
SetTimer
KillTimer
LoadImageW
DestroyIcon
InflateRect
GetDC
InvalidateRect
IsWindow
PostMessageW
GetParent
LoadCursorW
DestroyCursor
GetClassInfoW
DefWindowProcW
EnableScrollBar
SetRect
GetSysColor
GetCursorPos
ScreenToClient
ShowScrollBar
PtInRect
SetCursor
IsWindowVisible
LoadStringW
wsprintfW
ShowWindow
SetWindowPos
UpdateWindow
ReleaseDC
MessageBoxW
EqualRect
SetWindowLongW
GetWindowLongPtrW

gdi32

SetBitmapDimensionEx
GetStockObject
SetPixel
Chord
BitBlt
Rectangle
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
SelectObject
CreateBitmap
GetTextExtentPoint32W
CreateFontIndirectW
GetCurrentObject
GetObjectW
CreateDIBSection
CreatePalette
GetDIBColorTable
StretchDIBits
SetDIBitsToDevice
SetDIBColorTable
GetBitmapDimensionEx
CreatePatternBrush
SetTextColor
SetBkColor
SetBkMode
DeleteDC
PlayEnhMetaFile
CreateFontW
DeleteEnhMetaFile

msimg32

TransparentBlt

comdlg32

GetFileTitleW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExA
RegEnumKeyExA
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptImportKey
CryptAcquireContextW
RegSetValueExA
RegQueryValueExA

shell32

ExtractIconExW
SHGetFileInfoW
ShellExecuteW
SHGetMalloc
SHFileOperationW

comctl32

ImageList_GetIconSize
ord17
ImageList_ReplaceIcon
ImageList_DrawEx

shlwapi

PathRemoveFileSpecW
StrStrIW
PathAddBackslashW
StrCpyW
PathFindFileNameW
PathFindExtensionW
PathAppendW
PathFileExistsW
PathCompactPathExW
PathFindFileNameA

ole32

CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipDrawImageI
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Xbad_function_call@std@@YAXXZ
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
_Cnd_wait
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Cnd_signal
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?uncaught_exceptions@std@@YAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcomp140

_vcomp_atomic_add_i4
_vcomp_barrier
omp_get_thread_num
omp_get_max_threads
_vcomp_for_dynamic_init
_vcomp_for_dynamic_next
_vcomp_set_num_threads
_vcomp_reduction_i8
_vcomp_reduction_i4
_vcomp_fork
_vcomp_for_static_simple_init
_vcomp_for_static_init
_vcomp_for_static_end

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetCloseHandle
InternetSetOptionW
InternetConnectW
InternetOpenW
InternetCrackUrlW
HttpSendRequestW
InternetReadFile
HttpQueryInfoW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast
__std_type_info_destroy_list
__current_exception
__current_exception_context
__RTtypeid
__std_type_info_compare
memcmp
memchr
__std_terminate
__std_exception_copy
__C_specific_handler
__std_exception_destroy
_purecall
strchr
wcschr
wcsrchr
_CxxThrowException
wcsstr
memset
memmove
memcpy

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
_invalid_parameter_noinfo
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_resetstkoflw
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_crt_atexit
_cexit
_initterm
terminate
_initterm_e
_beginthreadex

api-ms-win-crt-heap-l1-1-0

_aligned_free
free
_aligned_malloc
malloc
_recalloc
realloc
calloc

api-ms-win-crt-convert-l1-1-0

_wtoi
_wtof
strtod
strtol
_itow_s
atof
atoi
mbtowc
_itoa_s
strtoul

api-ms-win-crt-string-l1-1-0

_wcsicmp
isdigit
strcat_s
_wcsnicmp
_wcslwr_s
wcsspn
wmemcpy_s
tolower
strnlen
wcsncmp
wcsnlen
wcsncpy
wcscspn
strcmp
wcscpy_s
wcscat_s
toupper
iswdigit
wcstok_s
_stricmp
strncmp
strtok
strncpy
_wcsdup

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand
bsearch

api-ms-win-crt-stdio-l1-1-0

fread
__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
__stdio_common_vswprintf_s
ftell
fseek
fclose
__acrt_iob_func
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fopen

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-time-l1-1-0

_difftime64
_gmtime64_s
_gmtime64
_localtime64_s
_mktime64
_localtime64
_time64

api-ms-win-crt-math-l1-1-0

atan
atan2
atan2f
ceil
ceilf
exp
expf
asin
fmodf
log
log10
log2f
logf
acos
tan
_fdclass
_dclass
round
modf
hypot
fmin
fminf
pow
powf
roundf
sin
sinf
sqrt
sqrtf
fmaxf
floor
cos

xerces-c_2_7

?getIssueFatalErrorIfNotFound@InputSource@xercesc_2_7@@UEBA_NXZ
?setIssueFatalErrorIfNotFound@InputSource@xercesc_2_7@@UEAAX_N@Z
?endInputSource@XercesDOMParser@xercesc_2_7@@UEAAXAEBVInputSource@2@@Z
?expandSystemId@XercesDOMParser@xercesc_2_7@@UEAA_NQEB_WAEAVXMLBuffer@2@@Z
?resetEntities@XercesDOMParser@xercesc_2_7@@UEAAXXZ
?startInputSource@XercesDOMParser@xercesc_2_7@@UEAAXAEBVInputSource@2@@Z
?handleAttributesPSVI@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0PEAVPSVIAttributeList@2@@Z
?handlePartialElementPSVI@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0PEAVPSVIElement@2@@Z
?handleElementPSVI@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0PEAVPSVIElement@2@@Z
?TextDecl@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0@Z
?startExtSubset@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?startIntSubset@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?startAttList@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDElementDecl@2@@Z
?notationDecl@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVXMLNotationDecl@2@_N@Z
?resetDocType@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?entityDecl@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDEntityDecl@2@_N1@Z
?endExtSubset@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?endIntSubset@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?endAttList@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDElementDecl@2@@Z
?elementDecl@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDElementDecl@2@_N@Z
?doctypeWhitespace@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_WI@Z
?doctypePI@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0@Z
?doctypeDecl@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDElementDecl@2@QEB_W1_N2@Z
?doctypeComment@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W@Z
?attDef@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVDTDElementDecl@2@AEBVDTDAttDef@2@_N@Z
?getPublicId@InputSource@xercesc_2_7@@UEBAPEB_WXZ
?resolveEntity@XercesDOMParser@xercesc_2_7@@UEAAPEAVInputSource@2@PEAVXMLResourceIdentifier@2@@Z
?resetErrors@XercesDOMParser@xercesc_2_7@@UEAAXXZ
?error@XercesDOMParser@xercesc_2_7@@UEAAXIQEB_WW4ErrTypes@XMLErrorReporter@2@000JJ@Z
?createElementNSNode@AbstractDOMParser@xercesc_2_7@@MEAAPEAVDOMElement@2@PEB_W0@Z
?setPSVIHandler@AbstractDOMParser@xercesc_2_7@@UEAAXQEAVPSVIHandler@2@@Z
?elementTypeInfo@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0@Z
?XMLDecl@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W000@Z
?startEntityReference@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVXMLEntityDecl@2@@Z
?startElement@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVXMLElementDecl@2@IQEB_WAEBV?$RefVectorOf@VXMLAttr@xercesc_2_7@@@2@I_N3@Z
?startDocument@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?resetDocument@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?ignorableWhitespace@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_WI_N@Z
?endEntityReference@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVXMLEntityDecl@2@@Z
?endElement@AbstractDOMParser@xercesc_2_7@@UEAAXAEBVXMLElementDecl@2@I_NQEB_W@Z
?endDocument@AbstractDOMParser@xercesc_2_7@@UEAAXXZ
?docPI@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W0@Z
?docComment@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_W@Z
?docCharacters@AbstractDOMParser@xercesc_2_7@@UEAAXQEB_WI_N@Z
?setSystemId@InputSource@xercesc_2_7@@UEAAXQEB_W@Z
?setPublicId@InputSource@xercesc_2_7@@UEAAXQEB_W@Z
?setEncoding@InputSource@xercesc_2_7@@UEAAXQEB_W@Z
?makeStream@MemBufInputSource@xercesc_2_7@@UEBAPEAVBinInputStream@2@XZ
??1XercesDOMParser@xercesc_2_7@@UEAA@XZ
??1MemBufInputSource@xercesc_2_7@@UEAA@XZ
?getDocument@AbstractDOMParser@xercesc_2_7@@QEAAPEAVDOMDocument@2@XZ
?parse@AbstractDOMParser@xercesc_2_7@@QEAAXAEBVInputSource@2@@Z
??0XercesDOMParser@xercesc_2_7@@QEAA@QEAVXMLValidator@1@QEAVMemoryManager@1@QEAVXMLGrammarPool@1@@Z
??0MemBufInputSource@xercesc_2_7@@QEAA@QEBEIQEBD_NQEAVMemoryManager@1@@Z
??2XMemory@xercesc_2_7@@SAPEAX_K@Z
?Terminate@XMLPlatformUtils@xercesc_2_7@@SAXXZ
?fgXercescDefaultLocale@XMLUni@xercesc_2_7@@2QBDB
?Initialize@XMLPlatformUtils@xercesc_2_7@@SAXQEBD0QEAVPanicHandler@2@QEAVMemoryManager@2@_N@Z
?fgMemoryManager@XMLPlatformUtils@xercesc_2_7@@2PEAVMemoryManager@2@EA
??3XMemory@xercesc_2_7@@SAXPEAX@Z
?getSystemId@InputSource@xercesc_2_7@@UEBAPEB_WXZ
?getEncoding@InputSource@xercesc_2_7@@UEBAPEB_WXZ
?resolveEntity@XercesDOMParser@xercesc_2_7@@UEAAPEAVInputSource@2@QEB_W00@Z

crypt32

CryptBinaryToStringA

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageGetDigestStream
ImageEnumerateCertificates

Exports

Exports

CXP_Free
CXP_GetPlugInInfo
CXP_Help
CXP_Init
CXP_InvokeCommand
CXP_ShowPlugInDialog

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 850KB - Virtual size: 849KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2988b863e60b5a606803e16d3c7551d2

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d2d1

dxgi

mfc140u

kernel32

user32

gdi32

msimg32

comdlg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

msvcp140

vcomp140

version

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

xerces-c_2_7

crypt32

api-ms-win-crt-locale-l1-1-0

imagehlp

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 850KB - Virtual size: 849KB

.data Size: 79KB - Virtual size: 239KB

.pdata Size: 112KB - Virtual size: 112KB

_RDATA Size: 209KB - Virtual size: 208KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 850KB - Virtual size: 849KB

.data
Size: 79KB - Virtual size: 239KB

.pdata
Size: 112KB - Virtual size: 112KB

_RDATA
Size: 209KB - Virtual size: 208KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 21KB - Virtual size: 20KB